This Jira covers two issues found during the integration testing of the security groups:

1) vhost_user driver connect() to the unix socket is blocking, and hangs the entire VPP if the other end does not call accept() in a timely fashion. Solution: make the socket file descriptor non-blocking for the duration of the connect.

2) macip ACL is blocking ARP traffic. The classifier table tracking was missing. Solution: add the creation of the classifier table to permit corresponding ARP traffic.